Filebeat doesnt update the log file

Elastic Stack Kibana
1

Hi

I have deleted few entries from my log file. But filebeat still shows them when I see the kibana dashboard. How to update filebeat not to store deleted items . I have tried close_* options. Didnt work.

2

Hi Gayathri,

Could you please brief about your setup such as which products you are using like Elasticsearch, logstash etc..

Regards,
Harsh Bajaj

3

Hi @harshbajaj16

I am using filebeat to read multiple log files and send them to Elasticsearch. Kibana then uses that data.

4

Hi @Gayathri.Srivathsan,

FIlebeat ships the log to elasticsearch and elasticsearch store the data and it visible on kibana dashboard. it means once the data have been shipped it stores in elasticsearch as index so you need to delete the entries from index via delete API available in elasticsearch not actual file/data which is already shiped by fileebat.

Or

You can delete the full index from elasticsearch and reshipped the data from filebeat to elasticsearch.

Regards,
Harsh Bajaj

5

Thanks @harshbajaj16

But dont the count_* fields work? I thought they do this.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.